CVE-2002-1405: CRLF injection vulnerability in Lynx 2.8.4 and earlier allows remote attackers to inject false HTTP headers...

Security readout for executives and security teams

This issue affects Lynx 2.8.4 and earlier when a URL supplied on the command line contains encoded newline characters. A remote party who can influence that URL may cause Lynx to send extra, false HTTP headers. Business impact depends on whether old Lynx is still used in scripts, automation, or user workflows with untrusted URLs. Most exposure is legacy or embedded: systems running Lynx 2.8.4 or earlier and invoking it with attacker-influenced command-line URLs. Modern environments are unlikely to be affected unless old packages remain in automation, admin tooling, or minimal server images. Treat this as a legacy hygiene issue unless old Lynx is confirmed in production automation. Prioritize discovery first, then patch or remove affected installations. It should not outrank actively exploited vulnerabilities without evidence of exposure. Mitigation focus: Inventory Lynx installations and identify versions at or below 2.8.4.; Apply relevant OS vendor updates from supported package repositories or advisories.; Remove or replace obsolete Lynx packages where no supported update exists..

Prepared

Jun 30, 2026, 03:39 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.